Another exploit - Wholly Unsecured Database

[ArchDizzle]

Raymond R. Fafs here, FBI square enix crimes division. Illegal against the law criminal activity in online games is something we take very seriously. According to Federal law, Stature 186.1.1.420, It is illegal to "Own", "Own the shit out of", "Completely fucking wreck", "Deep dick", "Balls to the walls deep", "cmonandslam.exe on", "Rip a new one", "Totally ruin", "Clam stamp", "Totally illegally exploit", "Turn into poop", "Gustaface on", "Squirt a loaf on", "Trap sprung" or "Double fuck" a game's economy for personal benefit. This includes not only final fantasy 14 and salvage, but also: Monopoly fraud, Writing down more gold then your DM gave you for an encounter, drawing more then one card during your draw phase, and placing extra armies on Australia so the other guy can't mess with you, as well as: Hiring a swarthy foreigner to click cookies for you, making chili poppers, selling vanity mounts for way too much, actually using economic principals in games to circumvent endless grinding, applying treasure hunter to any monster, providing gil services without a 100 percent handwork, and selling mastered all materia on the black market for drugs. If you have any information on someone ruining everyone elses fun contact local law enforcement by posting on the official forums snitching subforum and as soon as the government is back up and running we'll have our best men on the case.

This was fantastic.

[lilbubbles]

I don't know anything about programming, but is there some kind of advantage to making it so easy for people to access the server data in the first place? Lower load times? Kinda dumb this was allowed to happen in the first place.

It's actually slower. Servers are so stupidly fast right now it isn't funny. The bottleneck with anything server related anymore is the communication between the client and server. That is why the only thing you trust the client with is their position (otherwise you rubberband), but you still verify it lol.

[Anton]

You could either edit the item you were buying (this worked) or perhaps just edit the item in your inventory and use it (unsure).

Not saying that what's being talked about isn't happening, I'm just nearly positive that if you want an example of it, this isn't it.

Pretty sure thats exactly whats being described in the OP

[Oreth]

Why am i always late to the party....

[kemigumi]

because dishwalla

[Deimos]

Why does everyone just seem to be believing that this is true based on the claims of a couple of random people, including a 1-post throwaway account? The initial premise of this thread (explaining the screenshot of the guy leveling CRP extremely quickly) doesn't even make sense as a result of the claimed "tell the server whatever you want" exploit.

If he could just tell the server he was CRP50, why did he go up one level at a time? Why did he do it in a location where other players would be able to see? Why did he receive achievements for turning in guildleves? If that screenshot is real, it's very clearly showing some sort of exploit related to being able to turn in leves repeatedly.

[Kuishen]

Why does everyone just seem to be believing that this is true based on the claims of a couple of random people, including a 1-post throwaway account? The initial premise of this thread (explaining the screenshot of the guy leveling CRP extremely quickly) doesn't even make sense as a result of the claimed "tell the server whatever you want" exploit.

Because it's SE and pretty believable. Also massive amounts of gil being removed from the game, as well as the character that had the legacy mount and all minions on a non-legacy server. I saw the page myself back when it was first posted, he had everything.

If he could just tell the server he was CRP50, why did he go up one level at a time?

The timestamps all happened within a 1 second timeframe, the game is probably hard-wired to give the level up message regardless so it gave them all to him. There's nothing weird about that.

Why did he do it in a location where other players would be able to see?

Because he's stupid and/or wanted to show off.

Why did he receive achievements for turning in guildleves?

I saw some math on reddit that indicated that it's not possible for him to have gotten that amount of money from leves even with a full 100 allowance for the achievements. So the logical explanation is that he simply told the server to turn in a ton of guild leves leveling AND making money at the same time. This explains the level up messages better and the achievements and based on the nature of the exploit is entirely within the realm of possibility.

It is also possible that the original screenshot is indeed a separate exploit, however in the process of finding out how it happened, the OP found something even worse. I'll agree that there is no concrete evidence yet for the specific exploit mentioned in the OP but there's enough circumstantial evidence for me to believe it's possible.

[lexicum]

Even if this was true, leveling up like that just saves you a 2-3 days of harcore playtime. As for the billions of gil, what are they going to buy with it at this stage of the game? Unless there is a mass hacking event, I don't see this being this hack being a big concern.

[Kuishen]

Even if this was true, leveling up like that just saves you a 2-3 days of harcore playtime. As for the billions of gil, what are they going to buy with it at this stage of the game? Unless there is a mass hacking event, I don't see this being this hack being a big concern.

lol

[Zetanio]

Even if this was true, leveling up like that just saves you a 2-3 days of harcore playtime. As for the billions of gil, what are they going to buy with it at this stage of the game? Unless there is a mass hacking event, I don't see this being this hack being a big concern.

You... I like you.

[lexicum]

Thank you.

[Kincard]

Even if this was true, leveling up like that just saves you a 2-3 days of harcore playtime. As for the billions of gil, what are they going to buy with it at this stage of the game? Unless there is a mass hacking event, I don't see this being this hack being a big concern.

The combat part of the game won't really be affected much by the economy so if the only thing you care about is grinding to max level, beating Titan and getting your shiny weapon you'll have fun then quit the game in about a month, but more than half the classes are about gathering/crafting which are greatly affected by this.

Well, there's also those invincibility/teleporting hacks, and the fact that he can turn any item into any other item. At this point who knows how many hacks are in the game, or if they're all just multiple things resulting from the same exploit.

[lexicum]

Sorry, maybe I should have put 1 week for a gathering class.

[arus2001]

I'm skeptical of the item editing vid solely because of how easy it would be to fake UI overlays with some video editing software and enough patience. Grab the game font, sample a gray block from the blank UI area, copy/stretch it over actual, type what you want to see after a well-timed pause, then pass it off as the real deal with footage resumed. Even the gil tally can be manipulated to acquire samples of each number, hiding the actual amount under the UI cover, and spoofing the copy as appropriate.

I'm of the mind that if this shit was out there, the economies would be far worse than they are. And sure, 360B sounds like a lot to us casual plebs, but think of all the gathering bots running 24/7, possible AH manipulations, jacking accounts, undisclosed legacy currency, and who knows what other actual legit exploits they may've found. In any other game where I've seen some kind of currency exploit surface, everything's usually jacked within 12 hours. The fact no other script kiddy has come out of the woodwork proving they've done it "to teach SE a lesson" also strikes me as things being more a phantom threat. So, while pet guy may've found a vulnerability SE's otherwise patched over, I'm just getting a red herring troll vibe here, if for any reason, to give the XIV haters something to giggle about.

[Ksandra]

As for the billions of gil, what are they going to buy with it at this stage of the game?

If that throwaway poster is being even remotely truthful, they sold it to rmt. Which honestly, makes semi sense in how cheap gil was on non legacy, and even legacy servers.

I'm skeptical of the item editing vid solely because of how easy it would be to fake UI overlays with some video editing software and enough patience. Grab the game font, sample a gray block from the blank UI area, copy/stretch it over actual, type what you want to see after a well-timed pause, then pass it off as the real deal with footage resumed. Even the gil tally can be manipulated to acquire samples of each number, hiding the actual amount under the UI cover, and spoofing the copy as appropriate.

I can't speak for the video, but my husband saw someone doing the lvl up craft super fast, and showed me on his laptop. Unfortunately, he didn't take an SS, so you'd have to obviously trust me. But, at least for me, I know that it happened for a fact since I saw his screen.

And sure, 360B sounds like a lot to us casual plebs, but think of all the gathering bots running 24/7, possible AH manipulations, jacking accounts, undisclosed legacy currency, and who knows what other actual legit exploits they may've found.

No that really is a lot when non legacy people were struggling to just pay for repair bills. Naturally speaking, when the game came out, more gil was getting taken out than generated because of high-end repairs/teleporting/etc.

The game, flat out, was not designed to generate barely any gil at all.

Really, when you look at the gil distribution, you need to look at the nonlegacy, as legacy servers started with an undisclosed amount of gil.

The fact that tons of people were able to get 8+mil gil on those servers strongly suggest that gil was not initially generated legitimately.

[Deimos]

I'm skeptical of the item editing vid solely because of how easy it would be to fake UI overlays with some video editing software and enough patience. Grab the game font, sample a gray block from the blank UI area, copy/stretch it over actual, type what you want to see after a well-timed pause, then pass it off as the real deal with footage resumed. Even the gil tally can be manipulated to acquire samples of each number, hiding the actual amount under the UI cover, and spoofing the copy as appropriate.

Or even without video editing, everything shown in that vid could have been done pretty easily with just editing memory to change how things display on the client, without actually affecting the server at all. If anyone remembers that "Costumer" app for FFXI where you could make your character look like it was any race/face and wearing any gear, it's the same principle as that. You just modify the game's memory so the client displays something different, it wasn't an exploit that actually changed your character's race and gear.

[Kincard]

Sorry, maybe I should have put 1 week for a gathering class.

I was more referring to the fact that gathering and crafting are largely economy-based so having people being able to magic 10 Brazilian gil into the ecnomy would kind of throw those out of whack. Also I know most of the people around here tend to be the more hardcore but even amongst the people here I'm sure there are very few that see grinding a gathering class for a week straight as something enjoyable or something that's trivialized- no sane person should value their time that little.

Snip

At this point, I'm more willing to believe that SE has once again screwed up basic coding rather than someone being so bored that they'll do an elaborate troll video with fake XIV overlays. Also I should note for the "teach SE a lesson" thing has actually happened before, because the guy who massively duped and hacked PSU when it first came out did it precisely because he wanted to "teach Sega a lesson". Never underestimate how determined/bored/obsessive video game nerds can be.

[Korialstrasz]

I'm surprised at people thinking gil isn't an issue because "there's nothing to buy". The fuck there isn't. I could find more than enough ways to spend 10s of millions buying gear and other shit. Just because there's not much use for it now, doesn't mean that there won't someday be something relic/mythic-esque where you'll be needing to throw hundreds of millions at stuff.

That said, having that much gil is bound to get your account all kinds of banhammered, but if I know I could get away with it I probably wouldn't pass up a billion gil because "it's not useful".

[Sephiroth]

The plot thickens.

(and no it's not 99,999,999, people asked that when the gil cut from 1.0->2.0 was going on and they said max gil would not be changed)

I had an extra 9 in my post. And that's what I thought the 1.0 cap was too. So what is the max gil SE were talking about? It would seem sloppy to leave it to the max number you can store in a 32 bit INT when every other cap in the game is a series of 9s, though that is what is shown in the screenshot.

[Kari]

I'm surprised at people thinking gil isn't an issue because "there's nothing to buy". The fuck there isn't. I could find more than enough ways to spend 10s of millions buying gear and other shit. Just because there's not much use for it now, doesn't mean that there won't someday be something relic/mythic-esque where you'll be needing to throw hundreds of millions at stuff.

That said, having that much gil is bound to get your account all kinds of banhammered, but if I know I could get away with it I probably wouldn't pass up a billion gil because "it's not useful".

Idk how people think there's nothing to buy. If I had infinite gil, I'd have a lot of great HQ food, penta-melded HQ crafted gear for each job, ability to bribe people, etc.
Penta-melded HQ gear is already a ton of improvement for most people. Prevents you from needing to farm Darklight, is better than darklight, allows you to not be gimp while not investing heavily in myths/etc.

Not to mention, having every job/craft at 50 is a huge skip in time sink [>MMOs], and with that gear you'd be better geared than most of the server on every job.